Security Warnings — Vendor: github

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

2026-05-13 GHSA-JJ37-3377-M6VV

highGitHub GitHub 2026-W20

edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint

2026-05-13 CVE-2026-42860

highGitHub GitHub 2026-W20

Electerm users can run dangrous code through link or command line

2026-05-13 CVE-2026-43944

criticalGitHub GitHub 2026-W20

esm.sh: Legacy Route Path Traversal Can Lead to RCE

2026-05-13 CVE-2026-44593

criticalGitHub GitHub 2026-W20

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

2026-05-13 CVE-2026-44594

highGitHub GitHub 2026-W20

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

2026-05-13 CVE-2026-42303

mediumGitHub GitHub 2026-W20

exiftool-vendored vulnerable to argument injection via newline characters in tag names

2026-05-13 CVE-2026-43893

highGitHub GitHub 2026-W20

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

2026-05-13 CVE-2026-42875

mediumGitHub GitHub 2026-W20

ExternalSecrets vulnerable to privilege escalation with secret overwriting

2026-05-13 CVE-2026-42876

mediumGitHub GitHub 2026-W20

Fiber vulnerable to XSS in AutoFormat Content Negotiation

2026-05-13 CVE-2026-42554

mediumGitHub GitHub 2026-W20

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

2026-05-13 CVE-2026-42864

criticalGitHub GitHub 2026-W20

Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

2026-05-13 CVE-2026-41887

mediumGitHub GitHub 2026-W20

Flowise: Bcrypt Password Hash Exposure

2026-05-13 CVE-2026-8026

mediumGitHub GitHub 2026-W20

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

2026-05-13 CVE-2026-43995

mediumGitHub GitHub 2026-W20

Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

2026-05-13 CVE-2026-42188

lowGitHub GitHub 2026-W20

GitPython: Unsafe option check validates multi_options before shlex.split transformation

2026-05-13 CVE-2026-42284

highGitHub GitHub 2026-W20

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

2026-05-13 CVE-2026-44740

mediumGitHub GitHub 2026-W20

Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy

2026-05-13 CVE-2026-45083

criticalGitHub GitHub 2026-W20

Grafana public dashboards disclose all direct mode datasources

2026-05-13 CVE-2026-27877

mediumGitHub GitHub 2026-W20

Granian vulnerable to DoS via WSGI response header panic

2026-05-13 CVE-2026-42545

mediumGitHub GitHub 2026-W20

Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

2026-05-13 CVE-2026-42544

highGitHub GitHub 2026-W20

Grav API Privilege Escalation to Super Admin

2026-05-13 CVE-2026-42843

highGitHub GitHub 2026-W20

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

2026-05-13 CVE-2026-42841

mediumGitHub GitHub 2026-W20

Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override

2026-05-13 CVE-2026-42845

highGitHub GitHub 2026-W20

Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

2026-05-13 CVE-2026-42608

highGitHub GitHub 2026-W20

Grav is Vulnerable to Stored XSS via Tag Injection

2026-05-13 CVE-2026-42611

highGitHub GitHub 2026-W20

Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

2026-05-13 CVE-2026-42609

highGitHub GitHub 2026-W20

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

2026-05-13 CVE-2026-42613

criticalGitHub GitHub 2026-W20

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

2026-05-13 CVE-2026-42612

highGitHub GitHub 2026-W20

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

2026-05-13 CVE-2026-42607

criticalGitHub GitHub 2026-W20

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

2026-05-13 CVE-2026-42610

mediumGitHub GitHub 2026-W20

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

2026-05-13 CVE-2026-42842

mediumGitHub GitHub 2026-W20

Grav: Stored XSS via page title (data[header][title]) in admin panel

2026-05-13 CVE-2026-44737

mediumGitHub GitHub 2026-W20

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

2026-05-13 CVE-2026-44738

highGitHub GitHub 2026-W20

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

2026-05-13 CVE-2026-42199

mediumGitHub GitHub 2026-W20

HTTP/2 Stream Cancellation Attack

2026-05-13 CVE-2023-44487

mediumGitHub GitHub 2026-W20

Hugo's Node tool execution allows file system access outside the project directory

2026-05-13 CVE-2026-44301

mediumGitHub GitHub 2026-W20

i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

2026-05-13 CVE-2026-41693

highGitHub GitHub 2026-W20

i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters

2026-05-13 CVE-2026-42353

highGitHub GitHub 2026-W20

i18next-locize-backend has URL Injection via Unsanitized Path Parameters

2026-05-13 CVE-2026-41885

mediumGitHub GitHub 2026-W20

ip-address has XSS in Address6 HTML-emitting methods

2026-05-13 CVE-2026-42338

mediumGitHub GitHub 2026-W20

ipl/web is vulnerable to reflected XSS by malformed search requests

2026-05-13 CVE-2026-42224

highGitHub GitHub 2026-W20

Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

2026-05-13 CVE-2026-42174

mediumGitHub GitHub 2026-W20

Kirby CMS's read access to site, user and role information is not gated by permissions

2026-05-13 CVE-2026-42069

highGitHub GitHub 2026-W20

Kirby CMS's system API endpoint leaks installed version and license data to authenticated users

2026-05-13 CVE-2026-42051

mediumGitHub GitHub 2026-W20

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

2026-05-13 CVE-2026-44697

highGitHub GitHub 2026-W20

Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call

2026-05-13 CVE-2026-42541

mediumGitHub GitHub 2026-W20

Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component

2026-05-13 CVE-2026-44245

mediumGitHub GitHub 2026-W20

Langflow Knowledge Bases API is Vulnerable to Path Traversal

2026-05-13 CVE-2026-42048

criticalGitHub GitHub 2026-W20

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

2026-05-13 CVE-2026-45134

highGitHub GitHub 2026-W20

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

2026-05-13 CVE-2026-42181

mediumGitHub GitHub 2026-W20

Lemmy has SSRF in /api/v3/post via Webmention dispatch

2026-05-13 CVE-2026-42180

mediumGitHub GitHub 2026-W20

Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled

2026-05-13 CVE-2026-44305

mediumGitHub GitHub 2026-W20

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

2026-05-13 CVE-2026-44304

highGitHub GitHub 2026-W20

link-preview-js vulnerable to IPv6 and internal loopback attacks

2026-05-13 CVE-2026-43897

highGitHub GitHub 2026-W20

liquidjs has a Denial of Service via circular block reference in layout

2026-05-13 CVE-2026-41311

highGitHub GitHub 2026-W20

LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution

2026-05-13 CVE-2026-42045

mediumGitHub GitHub 2026-W20

locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

2026-05-13 CVE-2026-41886

highGitHub GitHub 2026-W20

Low-privileged Grav API users can create super-admin accounts via blueprint-upload

2026-05-13 CVE-2026-42844

highGitHub GitHub 2026-W20

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

2026-05-13 CVE-2026-44307

highGitHub GitHub 2026-W20